mail-imss.conf

# vim: syntax=python

# Please check https://github.com/cvandeplas/ELK-forensics for more information.
# Created by Christophe Vandeplas <christophe@vandeplas.com>

# Please look below and comment out the section about email archiving if you are not using it.

input {
  tcp {
    type => "mail_imss"
    port => 18004
    #codec => line { charset => "ISO-8859-1" }
  }
}

filter {
  if [type] == "mail_imss" {
    csv {
      separator => "	"
      columns => ["timestamp", "uuid", "email_src", "email_dst", "email_subject", "direction", "engine_action", "crap", "crap", "size", "crap", "crap", "action_id"]
    }
    if [action_id] == "0" {
      # drop non-final lines - this is done to remove multiple lines per email, 
      # however it has the disadvantage as you lose some data 
      drop{}
    }
    date {
      match => [ "timestamp", "YYYY/MM/dd HH:mm:ss 'GMT'ZZ" ]
    }
    # If you have configured a BCC in your IMSS software, this is the place to remove it from the logs
    # Otherwise it will be present in all the recipients.
    if ("archive@yourdomain.tld" in [email_dst]) {
      # mutate the content of the recipient to remove out email archive system
      mutate { gsub => [ email_dst, ";archive@yourdomain.tld", "" ] }
    }
    if [direction] == "1" {
      mutate {
        replace => ["direction", "in"]
      }
    } else {
      mutate {
        replace => ["direction", "out"]
      }
    }

    mutate {
      convert => ["size", "float"]
      split => [email_dst, ";"]
      remove_field => [ "message", "timestamp", "host", "crap", "column14", "column15", "column16", "column17", "column18", "column19", "column20", "column21", "column22", "column23", "column24", "column25", "column26", "column27", "column28", "column29", "column30" ]
    }
  }
}

output {
  if [type] == "mail_imss" {
    elasticsearch {
      index => "logstash-%{[type]}-%{+YYYY.MM}"
      host => "localhost"
    }
  }
}